[CDNi] Early AD review of draft-ietf-cdni-metadata-17

[Alexey Melnikov <[e-mail]>]

In order to speed up publication of this draft, I decided to do early AD
review. Here are my comments. My apologies if they are a bit cryptic, if
you are unsure of what I meant, please ask!

In 1.2: content can only be delivered using HTTP/1.1 and not HTTP/1.1
over TLS? Is last para saying that this is an unsolved problem (e.g.
LURK BOF solution is needed)?

In 4.1.2: hostname and IP addresses need to have defined syntaxes (at
least by reference). You also need to say whether IDN domain names are
allowed here.

In 4.1.5: does "case insensitive" only applies to ASCII range? I.e.,
encoded UTF-8 sequences in URIs are not affected.

In 4.2.6: URI needs a Normative Reference (RFC 3986).

In 4.3.7: need a reference to a document/registry defining ASNs.

In 6.1: need a reference to HTTP/1.1 spec.

Should OPTIONS method be allowed?

In 6.2/6.3: Is discovery of the initial URI truly out of scope? You can
define a .well-known URI to allow bootstrapping.
If it is defined, is it likely to be used?

In 7.3: Nit: HTTP/1.1 over TLS needs 2 references, not just one.

In 7.4: I think I am sad that you haven't defined any initial
authentication mechanism. Has this been discussed in the WG?

In 8.1, last para: a requirement to implement mutual authentication is
underspecified. Do you mean TLS mutual authentication? If yes, say so.
If other mechanisms can be used, say so as well.
If you meant to reference 8.5 here, please do so.

Why is this only a SHOULD (and not a MUST)?

In 8.2: similarly, how can the SHOULD be satisfied? Do you mean TLS or
something else? Reference 8.5?

In 8.3: similar issue.

Also encryption doesn't necessarily provide integrity of data, so the
last sentence sounds wrong.

In 8.4: similar issue.